Shor's quantum factoring algorithm on a photonic chip 
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Shor's quantum factoring algorithm finds the prime factors of a large number exponentially faster 
than any other known method a task that lies at the heart of modern information security, par- 
ticularly on the internet. This algorithm requires a quantum computer a device which harnesses 
the 'massive parellism' afforded by quantum superposition and entanglement of quantum bits (or 
qubits). We report the demonstration of a compiled version of Shor's algorithm on an integrated 
waveguide silica-on-silicon chip that guides four single-photon qubits through the computation to 
factor 15. 



The realization of a quantum computer presents an ex- 
citing prospect of modern science. The processing of in- 
formation encoded in quantum systems admitting quan- 
tum superposition and entanglement enables exponen- 
tially greater power for particular tasks. Originally con- 
ceived in the context of simulating complex quantum sys- 
tems, it was the development of Shor's quantum factoring 
algorithm [1 that showed the capability of factoring the 
product of two large prime numbers exponentially faster 
than any known conventional method [2 which has ig- 
nited efforts to fabricate such a device. 

Despite progress towards this goal, proof-of-principle 
demonstrations of Shor's algorithm have so far only been 
possible with liquid-state NMR [3] and bulk optical im- 
plementations of simplified logic gates [HE], owing to the 
need for several logic gates operating on several qubits, 
even for small-scale compiled versions. However, these 
approaches cannot be scaled to a large number of qubits 
due to the purity, size and stability limitations of these 
systems. We demonstrate a compiled version of Shor's al- 
gorithm operating on four qubits in which the processing 
occurs in a photonic circuit of several one- and two-qubit 
gates fabricated from integrated optical waveguides on a 
silica-on-silicon chip [6j [7] . Whereas the full Shors algo- 
rithm is designed to factorize any given input, a compiled 
version is designed to find the prime factors of a specific 
input. 

The quantum circuit our device implements is the com- 
piled version of Shor's algorithm for factorizing 15 [3l [4J [5] 
(Fig 1A). This algorithm uses five qubits, one of which, 
xo, is effectively redundant as it remains in a separa- 
ble state throughout. The physical implementation (Fig. 
IB) consists of two non-deterministic controlled-phase 
(CZ) gates (each with success P = 1/9, conditional on 
post selection) and six one-qubit Hadamard (H) gates 
[8]. The computation proceeds as follows (Figs. 1A, B): 
Four photons are input into the "0" or "1" waveguides 
to prepare the initial state \ipi n ) = \0) Xl \0) X2 (0)^ |l)/ 2 
(this does not represent 15, but rather the initialization 
for the compiled algorithm to compute the factors of 15). 
The H gates, implemented by 1/2 reflectivity directional 
couplers, then prepare each qubit in a superposition of 
and 1, such that the entire state is a superposition of all 
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FIG. 1: Integrated optical implementation of Shor's quan- 
tum factoring algorithm. (A) The quantum circuit. (B) 
Schematic of the waveguide on chip device that implements 
the quantum computation. The x n qubits carry the result of 
the algorithm; f n are additional qubit required for the com- 
putation to work. (C) Outcomes of the algorithm. 

possible four-bit inputspart of the 'massive parallelism' 
that gives rise to quantum speed-up. The core process is 
then performed by two independent CZ gates, each im- 
plemented by a network of three 1/3 directional couplers, 
that create a highly entangled output state [H [5] . Mea- 
surement of the output state of qubits x\ and #2, and 
classical processing, gives the results of the computation 
(see appendix). 

We simultaneously prepared four 790 nm photons via 
parametric down conversion, coupled them into and out 
of the chip with butt-coupled arrays of optical fibres, and 
detected them with silicon avalanche photo diodes at a 
typical coincidental rate of 100 Hz per measurement (in- 
tegrated for 30 s). We input the state |^ n ) and measured 
the output state of qubits x\ and X2] the output statis- 
tics (Fig. 1C) show the four binary outcomes 000, 010, 
100, 110 (including the x qubit). Outputs 010 and 110 
lead to the correct calculation for finding the order r = 4 
for the algorithm (see appendix), which then enables ef- 
ficient classical computation of the factors 3 and 5; 100 
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gives the trivial factors (1 and 15); and 000 is an ex- 
pected failure mode inherent to Shor's algorithm. The 
measured results have a fidelity of 99 ± 1% with the ideal 
probability distribution (dashed line). 

This demonstration of a small-scale compiled Shor's 
algorithm on a chip shows promise for quantum comput- 
ing in integrated waveguides. While it currently uses an 
inefficient single photon source and modest efficiency de- 
tectors, ongoing progress to address heralded gates, effi- 
cient sources and detectors [8] combined with the results 
presented here will allow large-scale quantum circuits on 
many qubits to be implemented. Any quantum computer 
is a many-particle, many-path interferometer; the capa- 
bility to implement such complex interferometers in a sta- 
ble and miniaturized architecture is therefore critical to 
the future realization of large-scale quantum algorithms. 

APPENDIX 

The device in Fig. IB performs a compiled version 
of the quantum routine in Shor's algorithm. Euler's 
theorem dictates that for all coprime integers a and 
N, there exists a least power r known as the order 
of a modulo A/", such that both a r = 1 mod N and 
1 < r < N. Provided r is even, then it follows that 
a r - 1 = [a r l 2 - l) [a r l 2 + l) = mod AT, implying N 
divides the product (a r l 2 — l) (a r l 2 + l). Since r is the 
order of a modulo A", and provided a r l 2 ^ — 1 mod A", 
then it follows that the factors of A" must each divide 
(a r l 2 — l) and (a r l 2 + l) . This therefore implies the fac- 
tors of N are given by the greatest common divisors of N 
and (a r l 2 ± l) (computed efficiently using Euclid's clas- 
sical algorithm). The most challenging part of Shor's 
algorithm, requiring the power of quantum computation, 
is to therefore find the order r of some randomly cho- 
sen coprime a of N. This is achieved by using entan- 
glement and superposition across two registers of qubits 
(the argument X{ and function fi registers) to compute 
the modular exponential function (MEF) a z mod A"; the 
resulting interference in a subsequent quantum Fourier 
transform (QFT) yields high peaks in amplitude for the 
argument qubits, from which r is determined (equivalent 
to the period of the MEF). 

The compiled version of Shor's algorithm we used com- 
putes the prime factor of 15 when a = 2 is chosen. 
This compilation reduces the required number of func- 
tion qubits (fi) by evaluating \og a [a z mod N] in place of 
a z x mod A"; reducing the number of function qubits from 
log a [A] to log 2 [log a [A]]. The Inverse QFT shown in Fig. 



1A does not need to be implemented in the quantum cir- 
cuit for this case (nor for any r = 2 l ,l e IN), and can be 
performed by classical processing. Part of this classical 
processing inverts the order of the computed quantum 
bits, as in Fig 1C. 

On inputting the state \tj) in ) = \0) xl \0) x2 |0) /1 |l) /2 
the circuit is designed to produce a product of 
two maximally entangled Bell pairs: |(|0) rcl |0)j 1 + 
I 1 )*! \l) f i)(\0) x2 |l> /2 + |l) x2 |0} /2 ). Tracing out the 
fi qubits allows the outputs of the quantum computa- 
tion to be obtained by measuring the Xi qubits in the 
computational basis, which combined with the 'redun- 
dant' qubit Xq in the zero state, yields the 3-bit output: 
X2,xi : xq = 000, 010, 100, or 110. These 3-bit numbers 
correspond to the values 0,2,4 and 6, respectively. The 
first number is an expected failure inherent to Shor's al- 
gorithm, while the third yields the trivial factors 1 and 
15. The second and fourth outcomes allow the calculation 
of the order r = 4, which via Euclid's classical algorithm 
efficiently yields the correct prime factors 3 and 5. This 
routine by itself has a success rate of 1/2; on repeating 
n times it yields an overall success rate of 1 — (l/2) n . 

Each single qubit Hadamard operation is deterministi- 
cally realized using a 1/2 reflectivity directional coupler. 
Each non-deterministic controlled phase gate (CZ) con- 
sists of three 1/3 reflectivity directional couplers: quan- 
tum interference at the central coupler imparts the con- 
trolled phase shift on the fi qubit conditional on the Xi 
qubit being in the ll)^. state; the other two 1/3 couplers 
balance the gate success probability (1/9), conditional on 
detecting one photon in the Xi modes and one photon in 
the fi modes. 

We thank R. Jozsa, A. Laing, A. Montanaro, S. 
Takeuchi and X. Q. Zhou for helpful discussions. 



* These authors contributed to the work equally 
t Electronic address: Jeremy. OBrien@bri stol.ac.uk| 

[1] P. W. Shor, Proc. 35th Ann. Symp. Found. Comp. Sci. 
(IEEE Comp. Soc. Press, California, 1994) p. 124. 

[2] This task lies at the heart of cryptographic security. 

[3] L. M. K. Vandersypen, et. al, Nature 414, 883 (2001). 

[4] C.-Y. Lu, et. a/., Phys. Rev. Lett. 99, 250504 (2007). 

[5] B. P. Lanyon, et al, Phys. Rev. Lett. 99, 250505 (2007). 

[6] A. Politi, et a/., Science 320, 646 (2008). 

[7] Matthews, J. C. F., Politi, A., Stefanov, A. & O'Brien, J. 
L. Nature Photon. 3 346 (2009). 

[8] J. L. O'Brien, Science 318, 1567 (2007), and Refs. therein. 



